NocoBase plugin-ai: Authorization bypass in getAccessibleAIEmployee (CVE-2026-125397)
NocoBase plugin-ai versions 2.1.0 through 2.2.41 contain an authorization bypass vulnerability allowing authenticated users to access and control unauthorized AI employee configurations and tools.
CVE search metadata
CVE search record: CVE-2026-125397. Severity: high. CVSS: 7.1. KEV: no. Product: plugin-ai (2.1.0 through 2.2.41). Brief: NocoBase plugin-ai: Authorization bypass in getAccessibleAIEmployee (CVE-2026-125397). Brief link: https://feed.craftedsignal.io/briefs/2026-11-nocobase-auth-bypass/
Triage facts
Revision 1- Applicability
- plugin-ai (2.1.0 through 2.2.41)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 10, 02:04 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
NocoBase plugin-ai versions 2.1.0 through 2.2.41 are affected by an authorization bypass vulnerability in the getAccessibleAIEmployee() function. An authenticated user can bypass role-based access controls by providing a specific username parameter, which overrides the intended filter. This allows the attacker to access AI employees that were not assigned to their role.
Impact
Successful exploitation allows an authenticated user to perform unauthorized actions, including:
- Accessing unassigned AI employees.
- Executing tools and utilizing permissions associated with restricted AI employees via the
dispatch-sub-agent-tasktool. - Reading sensitive information, including prompts and tool configurations, via the
get-ai-employeetool.
Recommendation
- Upgrade NocoBase plugin-ai to a version later than 2.2.41 to remediate CVE-2026-125397.
- Audit access logs for the
dispatch-sub-agent-taskandget-ai-employeeAPI endpoints to identify anomalous usage patterns by unauthorized users. - Review user roles and permissions within the NocoBase platform to ensure least privilege principles are enforced.
Immediate actions
Patch NocoBase plugin-ai to a version beyond 2.2.41.
Threat Hunt
Monitor web application access logs for repeated calls to /api/get-ai-employee or /api/dispatch-sub-agent-task by users who do not have assigned AI employee roles.
Data: Web server access logs, Application level audit logs
Mitigations
Upgrade plugin-ai to version 2.2.42 or later.
CVE-2026-125397